Skip to main content

​
Rooms

A Room is the primary unit of collaboration in Enclave. Think of it as a secure, encrypted folder with its own membership list, access controls, and audit trail. Every file inside a room is encrypted with the room’s data encryption key (DEK). Members are granted access by having the DEK wrapped with their public key — they can decrypt files only if they hold the corresponding private key. Learn more about Rooms →

​
Encryption model

Enclave uses a hybrid encryption scheme:
  1. File encryption — each file is encrypted with a unique DEK using AES-256-GCM on the client before upload.
  2. Key wrapping — the DEK is wrapped (encrypted) with the room’s key encryption key (KEK).
  3. KEK management — the KEK is protected by your KMS or HSM. Kvelden never has access to unwrapped KEKs.
The server stores only ciphertext. Decryption happens on the client after the DEK is retrieved and unwrapped. Learn more about Encryption →

​
Key management

Learn more about Key Management →

​
Organisations and Org Units

Your Organisation is the top-level tenant in Enclave. Within it you create Org Units — logical groupings that mirror your structure (teams, departments, subsidiaries). Room access is granted at the Org Unit level. A user must be a member of the Org Unit that owns a room to access it. Learn more about Org Units →

​
Clearance levels

Enclave supports classification-based access control orthogonal to room membership: A user can only access a file if they have both the required Org Unit membership and a clearance level ≥ the file’s classification. Learn more about Clearance →

​
Audit logs

Every access event in Enclave is written to an append-only audit log. Each entry is cryptographically signed — the log cannot be altered without detection. Learn more about Audit Logs →